@tendrilapp/cli 0.1.19 → 0.1.21

package/dist/SKILL.md

@@ -20,12 +20,47 @@ Non-negotiables (the CLI enforces these; do not fight them):
 - Sub-bar results are honest, not failures to hide: exit 5 ships the
   bundle with real scores. Report them as they are.
 
-First-run friction: if tendril/Figma tool calls are hitting permission
-prompts, tell the user ONE approval can replace them all and offer
-`tendril_permissions` with `write: true` — it merges the pipeline's
-per-tool allowlist into the project's `.claude/settings.local.json`
-(idempotent, touches nothing else; the user reloads the session to
-apply). Never run it unoffered: it edits the user's settings.
+Permissions, FIRST THING in every pipeline run (the trigger is a FILE
+CHECK, not prompt-watching — you cannot observe permission prompts, so
+never condition on them; a measured session full of prompts had a
+prompt-conditioned offer never fire): check whether ANY Claude
+settings file the host merges — the project's
+`.claude/settings.local.json` or `.claude/settings.json`, or the
+user's `~/.claude/settings.json` — contains tendril MCP entries
+(plugin installs use `mcp__plugin_tendril_tendril__*`; direct
+`claude mcp add` installs use `mcp__<server-name>__*`). If none does,
+BEFORE the first recording call, tell the user one approval can
+replace every pipeline prompt and offer `tendril_permissions` with
+`write: true` — it merges the per-tool allowlist into the project's
+settings.local.json (idempotent, touches nothing else; note it writes
+PLUGIN-prefixed names — a direct-install user should run
+`tendril permissions --claude` and adapt the prefix instead) and the
+user must reload the session to apply; say that out loud. Offer ONCE
+per session; never run it unoffered (it edits the user's settings),
+and if declined, proceed without mentioning it again.
+
+Long generator/score waits: silence is not a health signal, and POLL
+cadence is not RELAY cadence (run 13: rounds landed 6–11 minutes apart,
+so a correct 30s poll still left the user in 9-minute silences they
+flagged as unacceptable). Two duties: relay each round's result the
+moment `<candidateDir>/score-history.jsonl` gains a line ("round 3
+scored: 15/21 at floor 0.885"), AND when more than ~60 seconds pass
+with no round, emit a liveness line from the candidate dir's file
+mtimes, which move while the generator is WRITING (thinking pauses are quiet — that is normal, not frozen) ("still
+working — styles.css touched 20s ago"). The history file APPEARS ONLY
+AFTER THE FIRST completed score, so its absence early is normal, not
+frozen. A healthy run can take 30+ minutes; never kill on elapsed time
+alone — count staleness from the LAST CHANGE to any signal, and when
+past ~20 minutes of true staleness, ask the user before killing.
+
+Before concluding "inherent limitation" on a stuck score: enumerate the
+rendering inputs you have NOT verified — are the declared font faces
+actually resolved (the kit's cached faces and weights vs what the CSS
+asks for), computed styles vs authored styles, and
+platform text antialiasing — and check them first. Run 13's "inherent
+fidelity gap" was a missing font weight one check away; a stop rule is
+for avoiding thrash, never for converting an unverified hypothesis into
+a final answer.
 
 Batch runs (several components in one session):
 - Cap concurrent recorders at FOUR. All recorders share one Figma

package/dist/tendril-mcp.js

@@ -66,7 +66,7 @@ var TOOLS = [
   },
   {
     name: "tendril_permissions",
-    description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. USE THIS when tendril/Figma tool calls keep hitting permission prompts: offer it to the user once \u2014 ONE approval here replaces a prompt per pipeline call (run 8 measured 16+ prompts for a single component's recording). The user must reload the session for new settings to apply.",
+    description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* (for those, write:true installs PLUGIN-prefixed names that will not match: list without writing and adapt the prefix instead). A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
     schema: z.object({
       write: z.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries")
     }),

package/dist/tendril.js

@@ -2274,6 +2274,31 @@ var init_report = __esm({
   }
 });
 
+// packages/verify/src/mount-limits.ts
+function lcdTextDisabled() {
+  return process.env["TENDRIL_DISABLE_LCD_TEXT"] === "1";
+}
+function mountArgs() {
+  return [MEMORY_CAP_ARG, ...lcdTextDisabled() ? ["--disable-lcd-text"] : []];
+}
+function raceMountDeadline(work, deadlineMs, onDeadline) {
+  return Promise.race([
+    work,
+    new Promise((resolve) => {
+      const timer = setTimeout(() => resolve(onDeadline()), deadlineMs);
+      timer.unref();
+    })
+  ]);
+}
+var MEMORY_CAP_ARG, ENGINE_MOUNT_DEADLINE_MS;
+var init_mount_limits = __esm({
+  "packages/verify/src/mount-limits.ts"() {
+    "use strict";
+    MEMORY_CAP_ARG = "--js-flags=--max-old-space-size=512";
+    ENGINE_MOUNT_DEADLINE_MS = 3e4;
+  }
+});
+
 // packages/verify/src/image-diff.ts
 import { PNG } from "pngjs";
 import pixelmatch from "pixelmatch";
@@ -3030,7 +3055,7 @@ ${input.tokensCss}
 ${input.files.css}
 #root { display: inline-block; }
 </style></head><body><div id="root"></div><script>${js}</script></body></html>`;
-  const browser = await chromium.launch({ executablePath, headless: true });
+  const browser = await chromium.launch({ executablePath, headless: true, args: mountArgs() });
   try {
     const page = await browser.newPage({ viewport: { width: 800, height: 600 } });
     await page.setContent(html, { waitUntil: "load" });
@@ -3268,6 +3293,7 @@ var init_visual_facts = __esm({
   "packages/verify/src/visual-facts.ts"() {
     "use strict";
     init_browser();
+    init_mount_limits();
     init_image_diff();
     RESOLVE_DIR = path7.resolve(path7.dirname(fileURLToPath2(import.meta.url)), "..");
     TOLERANCE_PX = 2;
@@ -3485,25 +3511,6 @@ var init_font_faces = __esm({
   }
 });
 
-// packages/verify/src/mount-limits.ts
-function raceMountDeadline(work, deadlineMs, onDeadline) {
-  return Promise.race([
-    work,
-    new Promise((resolve) => {
-      const timer = setTimeout(() => resolve(onDeadline()), deadlineMs);
-      timer.unref();
-    })
-  ]);
-}
-var MEMORY_CAP_ARG, ENGINE_MOUNT_DEADLINE_MS;
-var init_mount_limits = __esm({
-  "packages/verify/src/mount-limits.ts"() {
-    "use strict";
-    MEMORY_CAP_ARG = "--js-flags=--max-old-space-size=512";
-    ENGINE_MOUNT_DEADLINE_MS = 3e4;
-  }
-});
-
 // packages/verify/src/admission.ts
 import { readFileSync as readFileSync5, readdirSync as readdirSync2, existsSync as existsSync7, writeFileSync as writeFileSync4 } from "node:fs";
 import path11 from "node:path";
@@ -4080,7 +4087,7 @@ async function checkBehaviors(task, bundleDir, opts = {}) {
   const js = await compileMount(task, bundleDir);
   if (typeof js !== "string") return task.behaviors.map((b) => ({ id: b.id, pass: false, detail: js.error }));
   const css = ["tokens.css", "styles.css"].map((f) => path13.join(bundleDir, f)).filter((f) => existsSync8(f)).map((f) => readFileSync6(f, "utf8")).join("\n");
-  const server = await chromium3.launchServer({ executablePath: resolveChrome(), headless: true, args: [MEMORY_CAP_ARG] });
+  const server = await chromium3.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium3.connect(server.wsEndpoint());
   const results = [];
   let deadlined = false;
@@ -4512,7 +4519,7 @@ if (root && C) createRoot(root).render(createElement(C, cfg.props));
     }
     return detectBackdrop(ref);
   };
-  const server = await chromium4.launchServer({ executablePath: resolveChrome(), headless: true, args: [MEMORY_CAP_ARG] });
+  const server = await chromium4.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium4.connect(server.wsEndpoint());
   const scores = [];
   try {
@@ -4705,7 +4712,7 @@ async function checkHoverParity(task, bundleDir, opts = {}) {
   const js = await compileMount(task, bundleDir);
   if (typeof js !== "string") return configs.map((c) => ({ id: `parity:${c.rep}`, pass: false, detail: js.error }));
   const css = ["tokens.css", "styles.css"].map((f) => path16.join(bundleDir, f)).filter((f) => existsSync11(f)).map((f) => readFileSync9(f, "utf8")).join("\n");
-  const server = await chromium6.launchServer({ executablePath: resolveChrome(), headless: true, args: [MEMORY_CAP_ARG] });
+  const server = await chromium6.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium6.connect(server.wsEndpoint());
   const results = [];
   try {
@@ -4879,7 +4886,7 @@ async function checkCropComposition(task, bundleDir, regions, opts = {}) {
     return regions.map((r) => ({ id: cropId(r), pass: false, similarity: 0, inkRecall: 0, detail: js.error }));
   }
   const css = ["tokens.css", "styles.css"].map((f) => path17.join(bundleDir, f)).filter((f) => existsSync12(f)).map((f) => readFileSync10(f, "utf8")).join("\n");
-  const server = await chromium7.launchServer({ executablePath: resolveChrome(), headless: true, args: [MEMORY_CAP_ARG] });
+  const server = await chromium7.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium7.connect(server.wsEndpoint());
   const PAD = 4;
   try {
@@ -4984,7 +4991,7 @@ async function checkStructuralComposition(task, bundleDir, roles, opts = {}) {
   const js = await compileInstrumentedMount(task, bundleDir);
   if (typeof js !== "string") return [...results, ...mains.map((m) => ({ id: `composition:${m}`, pass: false, detail: js.error }))];
   const css = ["tokens.css", "styles.css"].map((f) => path17.join(bundleDir, f)).filter((f) => existsSync12(f)).map((f) => readFileSync10(f, "utf8")).join("\n");
-  const server = await chromium7.launchServer({ executablePath: resolveChrome(), headless: true, args: [MEMORY_CAP_ARG] });
+  const server = await chromium7.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium7.connect(server.wsEndpoint());
   try {
     for (const mainSlug of mains) {
@@ -5124,7 +5131,7 @@ async function checkSiblingOcclusion(task, bundleDir, css, opts = {}) {
   const js = await compileTwoUp(task, bundleDir);
   if (typeof js !== "string") return [{ id: "sibling-overlay-hit-testable", pass: false, detail: js.error }];
   const timeoutMs = opts.mountDeadlineMs ?? ENGINE_MOUNT_DEADLINE_MS;
-  const server = await chromium8.launchServer({ executablePath: resolveChrome(), headless: true, args: [MEMORY_CAP_ARG] });
+  const server = await chromium8.launchServer({ executablePath: resolveChrome(), headless: true, args: mountArgs() });
   const browser = await chromium8.connect(server.wsEndpoint());
   try {
     const work = (async () => {
@@ -5250,6 +5257,7 @@ var init_src4 = __esm({
     init_containment();
     init_tasks();
     init_prelude();
+    init_mount_limits();
     init_font_faces();
     init_font_resolve();
     init_paths();
@@ -5289,7 +5297,9 @@ function environmentStamp(taskFamilies) {
     chrome = resolveChrome();
   } catch {
   }
-  return { chrome, chromeVersion: chrome === "unavailable" ? null : chromeVersion(), fontsManifestSha256: fontsHash };
+  const ver = chrome === "unavailable" ? null : chromeVersion();
+  const lcdOff = lcdTextDisabled() ? " (lcd-text-disabled)" : "";
+  return { chrome, chromeVersion: ver === null ? null : ver + lcdOff, fontsManifestSha256: fontsHash };
 }
 var init_environment = __esm({
   "packages/cli/src/environment.ts"() {
@@ -5532,7 +5542,7 @@ async function runDoctorChecks(options) {
   );
   try {
     const chrome = resolveChrome();
-    checks.push({ name: "browser", ok: true, detail: `${chromeVersion() ?? "version unknown"} at ${chrome}` });
+    checks.push({ name: "browser", ok: true, detail: `${chromeVersion() ?? "version unknown"}${lcdTextDisabled() ? " \u2014 EXPERIMENT override active (lcd-text-disabled): scores not comparable to default runs" : ""} at ${chrome}` });
   } catch (err) {
     checks.push({
       name: "browser",
@@ -8164,7 +8174,7 @@ ${propLines.join("\n")}
 
 ${syntheticCombos.length > 0 ? `UNRECORDED REACHABLE COMBINATIONS: the design's exclusive axis cannot express ${syntheticCombos.join(", ")} \u2014 the API split makes them reachable with NO recorded truth. Compose them from the recorded per-axis truth (paint variables: one axis sets, the other consumes), never invent a bespoke look, and list them in your report.
 ` : ""}${slots.length > 0 ? `CONTENT PROPS: every string prop defaults to its RECORDED text \u2014 render the PROP, never a hardcoded literal. Configs pass per-pose recorded strings wherever the recording varies, and pixels enforce them: a hardcoded string fails those configs. Content presence (a heading that only exists in some poses) follows the AXIS props; the string prop only supplies the text. RICH-TEXT DEFAULTS: when the recorded content is a multi-run rich node (mixed weights, an underlined link span) whose concatenation is the prop's default string, a plain-string default would flatten the recorded formatting \u2014 default the parameter to undefined and render the recorded rich markup when the prop is absent; a caller-supplied string then renders plainly. That mirrors the design tool's own emission logic and keeps every recorded pose pixel-exact.
-` : ""}Rules: plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom, and NEVER import the stylesheet from the entry module: the harness injects tokens.css and styles.css itself, and an entry that imports CSS does not compile here (measured cost: one full round, every config 0). The component renders the RECORDED content as its defaults \u2014 reproduce it from the emissions. ${forcingCanon}${fontsLine}The host sizes nothing: the component is its natural recorded size. FLUIDITY AFFORDANCE (emit it always): every ROOT width declaration rides width: var(--tendril-root-width, <recorded>px) with that pose's recorded width as the fallback \u2014 per-variant root widths reuse the SAME property name with their own recorded fallbacks. With the property unset this is byte-equivalent truth: identical pixels, identical operability measurement (measured: flipping roots to a bare 100% held 20/20 pixels but made a commit check unmeasurable \u2014 the recorded pin carries real signal). A consumer makes an instance fluid by setting --tendril-root-width (e.g. 100%) on a wrapper, no edit to certified CSS. Widths only: recorded heights and internal geometry stay literal \u2014 fixed heights are often genuine design intent.`;
+` : ""}Rules: generated element ids come from React's useId() \u2014 never Math.random() in render/state init (SSR hydration hazard; measured: two same-day bundles disagreed). Plain CSS in styles.css (tokens.css optional, loaded first) \u2014 no Tailwind, no imports beyond react/react-dom, and NEVER import the stylesheet from the entry module: the harness injects tokens.css and styles.css itself, and an entry that imports CSS does not compile here (measured cost: one full round, every config 0). The component renders the RECORDED content as its defaults \u2014 reproduce it from the emissions. ${forcingCanon}${fontsLine}The host sizes nothing: the component is its natural recorded size. FLUIDITY AFFORDANCE (emit it always): every ROOT width declaration rides width: var(--tendril-root-width, <recorded>px) with that pose's recorded width as the fallback \u2014 per-variant root widths reuse the SAME property name with their own recorded fallbacks. With the property unset this is byte-equivalent truth: identical pixels, identical operability measurement (measured: flipping roots to a bare 100% held 20/20 pixels but made a commit check unmeasurable \u2014 the recorded pin carries real signal). A consumer makes an instance fluid by setting --tendril-root-width (e.g. 100%) on a wrapper, no edit to certified CSS. Widths only: recorded heights and internal geometry stay literal \u2014 fixed heights are often genuine design intent.`;
   const mappedTokens = /* @__PURE__ */ new Set([...forcedStates, ...props.filter((p) => p.kind === "boolean").map((p) => p.name)]);
   const unmappedInteractionEvidence = interactionEvidence.filter((e) => {
     const sel = e.endsWith(" (selection axis)");
@@ -8256,7 +8266,7 @@ function dismissEvidence(setDir, repSlugs) {
   }
   return void 0;
 }
-function recordedFontNeeds(setDir) {
+function recordedFontNeeds(setDir, opts = {}) {
   const byFamily = /* @__PURE__ */ new Map();
   const unpaired = /* @__PURE__ */ new Set();
   const famAdd = (raw, weight) => {
@@ -8298,8 +8308,8 @@ function recordedFontNeeds(setDir) {
     if (existsSync21(defs)) fromDefs(envelopeText(defs));
   }
   return [...byFamily.entries()].map(([family, paired]) => {
-    const weights = /* @__PURE__ */ new Set([...paired, ...unpaired]);
-    return { family, weights: weights.size === 0 ? [400] : [...weights].sort((a, b) => a - b) };
+    const weights = /* @__PURE__ */ new Set([...paired, ...opts.pairedOnly === true ? [] : unpaired]);
+    return { family, weights: weights.size === 0 ? opts.pairedOnly === true ? [] : [400] : [...weights].sort((a, b) => a - b) };
   });
 }
 function symbolFontGlyphCount(setDir, reps) {
@@ -9261,10 +9271,19 @@ function unprovisionedFamilies(setDir, cacheDir) {
   const provided = new Set(verifiedFontFamilies(cacheDir).map((f) => f.family.toLowerCase()));
   return declared.filter((f) => !provided.has(f.toLowerCase()));
 }
+function unprovisionedFaces(setDir, cacheDir) {
+  return [
+    ...unprovisionedFamilies(setDir, cacheDir),
+    ...missingWeights(setDir, cacheDir).map((g) => {
+      const missing = g.declared.filter((w) => !g.provided.includes(w));
+      return `${g.family} (${missing.length === 1 ? "weight" : "weights"} ${missing.join(", ")})`;
+    })
+  ];
+}
 function missingWeights(setDir, cacheDir) {
   let needs;
   try {
-    needs = recordedFontNeeds(setDir);
+    needs = recordedFontNeeds(setDir, { pairedOnly: true });
   } catch {
     return [];
   }
@@ -9462,13 +9481,17 @@ async function runVerify(opts) {
       remediation: fontsUnprovenRemediation(task.set)
     });
   }
+  if (lcdTextDisabled()) {
+    warn(opts, "EXPERIMENT override active (TENDRIL_DISABLE_LCD_TEXT=1): text renders greyscale \u2014 scores are NOT comparable to default runs; the environment stamp and report are marked");
+  }
   const substitutedFamilies = unprovisionedFamilies(task.set);
   if (substitutedFamilies.length > 0) {
     warn(opts, `substituted fonts: cache lacks ${substitutedFamilies.map((f) => `"${f}"`).join(", ")} \u2014 scores measure a substitute face and no config can be certified under one (the stamp covers only the provisioned subset); resolve the families to certify`);
   } else if (opts.bar === "cert" && taskFontFamilies(task.set) === null) {
     warn(opts, "family coverage could not be established from this recording (no declared families) \u2014 the certification gate covers only cache non-emptiness here");
   }
-  for (const g of missingWeights(task.set)) {
+  const weightGaps = missingWeights(task.set);
+  for (const g of weightGaps) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
@@ -9580,7 +9603,18 @@ async function runVerify(opts) {
     // Machine-readable cause (adversarial review): a cert-bar failure
     // with zero pixel/behavior/composition failures was only
     // explainable from stderr prose.
-    ...certBlockedByAbsentInk.length > 0 ? { certBlockedByAbsentInk } : {}
+    ...certBlockedByAbsentInk.length > 0 ? { certBlockedByAbsentInk } : {},
+    ...weightGaps.length > 0 ? { fontWeightGaps: weightGaps } : {},
+    ...lcdTextDisabled() ? { environmentOverrides: ["disable-lcd-text"] } : {},
+    // Run 13 finding 1: the eye-check nudge lived only in the human
+    // footer, so MCP-driven agents — the documented path — were never
+    // told the check exists and shipped without ever opening a sheet.
+    // Structured here so every consumer sees it.
+    eyeCheck: {
+      command: `tendril inspect "${opts.bundleDir}"`,
+      sheetPath: path31.join(opts.bundleDir, "verify-evidence", "inspect.html"),
+      note: "magnified recorded-vs-rendered crops of every small node; scores cannot see shape. The command WRITES/refreshes the sheet at sheetPath \u2014 re-run it after every verify; an existing sheet may show stale crops."
+    }
   };
   emitData(opts, report, () => {
     for (const s of statuses) {
@@ -9672,9 +9706,15 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path31.join(opts.bundleDir, f)).filter((f) => existsSync25(f)).map((f) => readFileSync22(f, "utf8")).join("\n")));
     if (shippedFonts.length > 0 && substitutedFamilies.length === 0) {
       process.stdout.write(`fonts: scored with Tendril-cache faces \u2014 a consuming app must provision the same families (the bundle ships fonts.css when faces are shippable; sha-pinned list in component.json requiredFonts)
+`);
+    }
+    for (const g of weightGaps) {
+      process.stdout.write(`fonts (weight gap): "${g.family}" declares ${g.declared.join(", ")} \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (advisory, never a gate). Fix: tendril fonts resolve --set ${task.set}
 `);
     }
     process.stdout.write(`evidence: ${evidenceDir} (render/ref/diff per config)
+`);
+    process.stdout.write(`eye check: tendril inspect "${opts.bundleDir}" \u2014 magnified recorded-vs-rendered crops of every small node; scores cannot see shape (re-run after every verify)
 `);
   });
   if (opts.bar === "cert" && substitutedFamilies.length > 0) {
@@ -9780,8 +9820,9 @@ DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of
 ${notRecorded}` : "";
   let fontProvisioning;
   if (existsSync26(manifestPath2)) {
-    const provided = verifiedFontFamilies().map((f) => f.family);
-    const unprovided = recordedFontFamilies(task.set).filter((r) => !provided.some((p) => p.toLowerCase() === r.toLowerCase()));
+    const missingFams = unprovisionedFamilies(task.set);
+    const unprovided = unprovisionedFaces(task.set);
+    const weightOnly = missingFams.length === 0;
     if (unprovided.length > 0) {
       const names = unprovided.map((f) => `'${f}'`).join(", ");
       const PROPRIETARY = /^(sf pro|sf compact|sf mono|new york|pingfang|segoe ui|helvetica neue|proxima nova|avenir)/i;
@@ -9789,13 +9830,13 @@ ${notRecorded}` : "";
       fontProvisioning = {
         unprovided,
         question: {
-          prompt: `This design's text uses ${names}, which is not in the local font kit. How should it be handled?`,
+          prompt: weightOnly ? `This design implies font ${unprovided.length === 1 ? "weight" : "weights"} the local kit lacks: ${names} (the ${missingFams.length === 0 && unprovided.length === 1 ? "family itself is" : "families themselves are"} provisioned). How should it be handled?` : `This design's text uses ${names}, which is not in the local font kit. How should it be handled?`,
           options: [
-            allProprietary ? `(Recommended) ${names} ${unprovided.length === 1 ? "is a proprietary face" : "are proprietary faces"} \u2014 Google Fonts cannot serve ${unprovided.length === 1 ? "it" : "them"}, so skip \`fonts resolve\`: run \`tendril fonts add "<Family>" <weight> <file>\` with the .woff2/.ttf/.otf you hold a licence for (the file never leaves this machine), then re-run this brief \u2014 exact text fidelity.` : `(Recommended) Run \`tendril fonts resolve --set ${task.set}\` \u2014 open-source families are fetched automatically. Any face that fails there is one you license privately: run \`tendril fonts add "<Family>" <weight> <file>\` with the .woff2/.ttf/.otf you hold (the file never leaves this machine). Then re-run this brief \u2014 exact text fidelity.`,
-            'Continue with a substitute face: generation proceeds in a provided family, no config can score "certified" under it (cert-bar runs exit fonts-unproven after their report), the substitution is disclosed, and small text differences are expected and not fixable from CSS.'
+            allProprietary && !weightOnly ? `(Recommended) ${names} ${unprovided.length === 1 ? "is a proprietary face" : "are proprietary faces"} \u2014 Google Fonts cannot serve ${unprovided.length === 1 ? "it" : "them"}, so skip \`fonts resolve\`: run \`tendril fonts add "<Family>" <weight> <file>\` with the .woff2/.ttf/.otf you hold a licence for (the file never leaves this machine), then re-run this brief \u2014 exact text fidelity.` : `(Recommended) Run \`tendril fonts resolve --set ${task.set}\` \u2014 open-source families are fetched automatically. Any face that fails there is one you license privately: run \`tendril fonts add "<Family>" <weight> <file>\` with the .woff2/.ttf/.otf you hold (the file never leaves this machine). Then re-run this brief \u2014 exact text fidelity.`,
+            weightOnly ? "Continue with nearest-weight rendering: the family is provisioned, certification remains possible, and the gap rides the report as an advisory (fontWeightGaps); resolving removes it." : 'Continue with a substitute face: generation proceeds in a provided family, no config can score "certified" under it (cert-bar runs exit fonts-unproven after their report), the substitution is disclosed, and small text differences are expected and not fixable from CSS.'
           ]
         },
-        nonInteractive: opts.bar === "cert" ? `Resolve the families first (\`tendril fonts resolve --set ${task.set}\`) \u2014 this loop targets the cert bar, and scoring exits fonts-unproven under a substitute, so continuing without resolving is a dead end.` : "Continue with the substitute and state the substitution in your report."
+        nonInteractive: weightOnly ? `Run \`tendril fonts resolve --set ${task.set}\` if quick, or continue \u2014 the weight gap is an advisory, never a gate.` : opts.bar === "cert" ? `Resolve the families first (\`tendril fonts resolve --set ${task.set}\`) \u2014 this loop targets the cert bar, and scoring exits fonts-unproven under a substitute, so continuing without resolving is a dead end.` : "Continue with the substitute and state the substitution in your report."
       };
     }
   }
@@ -9865,6 +9906,9 @@ async function runEngineScore(opts) {
       remediation: fontsUnprovenRemediation(task.set)
     });
   }
+  if (lcdTextDisabled()) {
+    warn(opts, "EXPERIMENT override active (TENDRIL_DISABLE_LCD_TEXT=1): text renders greyscale \u2014 scores are NOT comparable to default runs; the environment stamp and report are marked");
+  }
   const substitutedFamilies = unprovisionedFamilies(task.set);
   if (substitutedFamilies.length > 0) {
     warn(opts, `substituted fonts: cache lacks ${substitutedFamilies.map((f) => `"${f}"`).join(", ")} \u2014 scores measure a substitute face and no config can be certified under one (the stamp covers only the provisioned subset); resolve the families to certify`);
@@ -9964,6 +10008,7 @@ METRIC DEADBAND (read before iterating on near-misses): the scored similarity/in
       bundleManifest: emitted.written[0],
       note: "styles.css was stamped with the bundle provenance comment on line 1 \u2014 preserve it in any post-score edit",
       allPass,
+      ...lcdTextDisabled() ? { environmentOverrides: ["disable-lcd-text"] } : {},
       // Run 11: generators read allPass:true and reported success on
       // bundles verify then FAILED on the interaction-evidence gate —
       // the oracle must say what verify will say, including this.
@@ -10273,7 +10318,7 @@ var init_server = __esm({
       },
       {
         name: "tendril_permissions",
-        description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. USE THIS when tendril/Figma tool calls keep hitting permission prompts: offer it to the user once \u2014 ONE approval here replaces a prompt per pipeline call (run 8 measured 16+ prompts for a single component's recording). The user must reload the session for new settings to apply.",
+        description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* (for those, write:true installs PLUGIN-prefixed names that will not match: list without writing and adapt the prefix instead). A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
         schema: z12.object({
           write: z12.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries")
         }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tendrilapp/cli",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Figma design systems → verified React components. CLI ruler + MCP server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",